Huntress has detailed an AhsayCBS intrusion affecting three backup servers in one organization, with webshells, cryptominers and a Python implant among the recovered tools.
The November 9 research examines servers breached between October 8 and 11, before the vendor’s hotfixes. Huntress links the intrusion to exploitation of CVE-2026-105133 and CVE-2026-105134, an authentication bypass and remote code execution flaw.
Investigators found five webshell families, including a loader that concealed encrypted payloads in PNG images. The Python implant was designed to load a DLL in memory and contact command-and-control infrastructure. A related Veeam server showed a credential-query command, but the number of credentials retrieved remains unknown.
Ahsay’s October 12 notice directs affected v10 deployments to hotfix 10.3.4.45 and v7–v9 deployments to 9.15.2.70, followed by a reboot.
The hotfix closes the observed entry point; it does not remove existing implants. Huntress recommends checking exposed servers for artifacts and, when found, rebuilding from a trusted backup and rotating reachable credentials.
